tags:

views:

788

answers:

5
+1  Q: 

Anyone know of a free XSS penetration testing tool?

I am looking for...

  • A spider/automated
  • Will find all input fields and queryStrings, then insert potential XSS discoveries
  • Reports any XSS vulnerabilities found
+5  A: 

Post on reddit "I finished securing my site and making it hacker-proof" with a link to it.

Tom Ritter  2009-06-09 21:15:42
Lol! .
Stefan Mai  2009-06-09 21:16:46
+1  A: 

You may want to check out nessus.

http://www.nessus.org/plugins/index.php?view=all&family=CGI+abuses+%3A+XSS

I haven't used them for xss, yet. But for other things I've been pretty happy, and it is is free.

nikudesu  2009-06-09 21:18:55
A: 

Open source free one my me (as a bookmarklet):- http://www.thespanner.co.uk/2009/03/25/xss-rays/

 2009-06-25 11:01:17
A: 

I found this Firefox addon, XSS me

Zombies  2009-06-26 13:44:35
A: 

Try Burp Proxy I used the free with some features. For input fields you can try Firefox plugin XssMe and SOQL Inject Me. I covered all of those in this post : http://www.tgerm.com/2009/02/xss-testing-acceptance-tools-software.html

tgerm  2010-02-09 19:49:16

related questions

Why does this remote script cause IE6 to hang?
HTTP input filter like mod_security for WebSphere?
Should I sanitize HTML markup for a hosted CMS?
HTML/Javascript app that runs on the filesystem, security issue
Gracefully closing a frame (toolbar) around an iframe
What's the best method for sanitizing user input with PHP?
How do you htmlencode using html agility pack?
XSS Blacklist - Is anyone aware of a reasonable one?
Do htmlspecialchars and mysql_real_escape_string keep my PHP code safe from injection?
What percentage of my time will be spent in user input verfication during web development?
How do you allow the usage of an <img> while preventing XSS?
What are the best practices for avoid xss attacks in a PHP site
How do use fckEditor safely, without risk of cross site scripting?
Will HTML Encoding prevent all kinds of XSS attacks?
Inform potential clients about security vulnerabilities?
Best Practice: Legitimate Cross-Site Scripting
Access to restricted URI denied code: 1012
How do you set up use HttpOnly cookies in PHP
When is it Best to Sanitize User Input?
How exactly do you configure httpOnlyCookies in ASP.NET?
How do you configure HttpOnly cookies in tomcat / java webapps?
Communicating between websites (using Javascript or ?)
Best regex to catch XSS (Cross-site Scripting) attack (in Java)?
Sanitising user input using Python
Catching SQL Injection and other Malicious Web Requests